CVE-2026-21714

Overview

Node.js is an asynchronous, event-driven JavaScript runtime designed for building scalable network applications. Since Node.js 8.4.0, its built-in http2 module has provided HTTP/2 clients and servers. The module is built on the nghttp2 library, which Node.js bundles, and each connection is represented by an Http2Session object managed by Node.js's native code.

A memory leak vulnerability (CVE-2026-21714) has been identified in Node.js's HTTP/2 server implementation. HTTP/2 flow control caps the connection-level window at 2^31-1 bytes, and a WINDOW_UPDATE frame on stream 0 that pushes the window past that limit is a connection error. nghttp2 correctly responds with a GOAWAY frame. However, Node.js did not pass that particular error on to its JavaScript layer, so the Http2Session behind the connection was never destroyed. An attacker who repeats this over many connections can make the server's memory grow until it runs out.

This behaviour maps to CWE-401 (Missing Release of Memory after Effective Lifetime), where a product does not release memory once it is no longer needed, slowly exhausting what remains. In Node.js, each session closed this way leaves its native and JavaScript state behind. This can degrade the server's performance and eventually crash it.

Exploitation requires only network access to a Node.js HTTP/2 server. A client opens a connection, sends one or more connection-level WINDOW_UPDATE frames that overflow the window, and repeats. No authentication or user interaction is needed. Because the leak builds up one connection at a time, an attack has to be sustained. Applications that do not run an HTTP/2 server are not affected. The Node.js project describes the issue as affecting HTTP/2 users on its supported 20.x, 22.x, 24.x and 25.x lines. The same error handling exists in every earlier line since the http2 module was added in 8.4.0.

Details

Module Info

• Product: Node.js
• Affected packages: node (built-in http2 module; src/node_http2.cc)
• Affected versions: >=8.4.0 <=19.9.0 >=20.0.0 <20.20.2 >=21.0.0 <=21.7.3 >=22.0.0 <22.22.2 >=23.0.0 <=23.11.1 >=24.0.0 <24.14.1 >=25.0.0 <25.8.2
• GitHub repository: https://github.com/nodejs/node
• Published packages: https://nodejs.org/en/download
• Package manager: Not applicable; Node.js is distributed as runtime builds from nodejs.org rather than as a published npm package
• Fixed in: Node.js 20.20.2, 22.22.2, 24.14.1, and 25.8.2 (upstream fixes, released March 24, 2026); Node.js NES v22.22.3 (22.x line, shipped March 25, 2026), v20.20.3 (20.x line, shipped March 27, 2026), v18.20.16 (18.x line, shipped March 30, 2026), v14.21.10 (14.x line, shipped April 1, 2026), v12.22.16 (12.x line, shipped April 2, 2026), and v16.20.11 (16.x line, shipped April 3, 2026), the 12.x through 18.x builds being for lines that never received an upstream fix before reaching End-of-Life

Vulnerability Info

This Medium-severity vulnerability is found in Http2Session::OnInvalidFrame in Node.js's HTTP/2 native code (src/node_http2.cc). The HackerOne CNA assigns a CVSS v3.0 score of 5.3, and the Node.js project also rates it Medium.

When nghttp2 reports an invalid frame, Node.js decides whether the error is serious enough to hand to JavaScript. Errors that end the connection are passed up so that the session's error path runs and the Http2Session is destroyed. In the vulnerable implementation, only fatal errors, NGHTTP2_ERR_STREAM_CLOSED and NGHTTP2_ERR_PROTO were passed up. The NGHTTP2_ERR_FLOW_CONTROL error, produced when stream-0 WINDOW_UPDATE frames overflow the connection window, was silently dropped after nghttp2 had already sent GOAWAY. The fix adds NGHTTP2_ERR_FLOW_CONTROL to the errors that are propagated, so the session is torn down. It shipped as commit a0c73425da on 20.x, 2a6105a63b on 22.x, c015edf313 on 24.x and d9c9b628cf on 25.x, through nodejs-private pull request #832.

An attacker would need to open many HTTP/2 connections to the server and trigger the overflow on each, accumulating leaked sessions faster than the process can tolerate.

Note: Because the leak is per connection, connection-rate limiting and process memory limits with automatic restarts reduce the impact, but they do not remove the underlying issue.

Mitigation

Node.js 22.x and 24.x are still supported and are fixed in 22.22.2 and 24.14.1 and later. Node.js 25.x reached End-of-Life on June 1, 2026, so the fix in 25.8.2 is the last for that line. Node.js 20.x reached End-of-Life on April 30, 2026, after its fix in 20.20.2. Every earlier line from 8.x through 19.x, along with 21.x and 23.x, never received an upstream fix. Node.js 12.x reached End-of-Life on April 30, 2022; Node.js 14.x on April 30, 2023; Node.js 16.x on September 11, 2023; Node.js 18.x on April 30, 2025; Node.js 19.x on June 1, 2023; Node.js 21.x on June 1, 2024; and Node.js 23.x on June 1, 2025. For more information see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade to Node.js 22.22.2 or later on the 22.x line, or to 24.14.1 or later on the 24.x line, both of which include this fix.
• Migrate affected applications away from the End-of-Life Node.js release lines.
• Leverage a commercial support partner like HeroDevs for post-EOL security support, through Node.js NES.

Credits

• galbarnahum (reporter)
• RafaelGSS (remediation developer)